Analysis Report https://ph-northwestmi.as.me/efreechurchdose1covid20210310

Overview

General Information

Sample URL: https://ph-northwestmi.as.me/efreechurchdose1covid20210310
Analysis ID: 368837
Infos:

Most interesting Screenshot:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 80%

Signatures

HTML body contains low number of good links
Suspicious form URL found

Classification

Phishing:

barindex
HTML body contains low number of good links
Source: https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566 HTTP Parser: Number of links: 1
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310 HTTP Parser: Number of links: 1
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: Number of links: 0
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes HTTP Parser: Number of links: 1
Source: https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566 HTTP Parser: Number of links: 1
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310 HTTP Parser: Number of links: 1
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: Number of links: 0
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes HTTP Parser: Number of links: 1
Suspicious form URL found
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: Form action: client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: Form action: client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3
Source: https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566 HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310 HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566 HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310 HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes HTTP Parser: No <meta name="author".. found
Source: https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566 HTTP Parser: No <meta name="copyright".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310 HTTP Parser: No <meta name="copyright".. found
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: No <meta name="copyright".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes HTTP Parser: No <meta name="copyright".. found
Source: https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566 HTTP Parser: No <meta name="copyright".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310 HTTP Parser: No <meta name="copyright".. found
Source: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 HTTP Parser: No <meta name="copyright".. found
Source: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes HTTP Parser: No <meta name="copyright".. found
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 13.224.94.16:443 -> 192.168.2.3:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.94.16:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.89.109:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.89.109:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.184.84.60:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.184.84.60:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: TV4F7E56.htm.2.dr String found in binary or memory: <li><a href="https://www.facebook.com/acuityscheduling/" alt="Scheduling on Facebook">Facebook</a></li> equals www.facebook.com (Facebook)
Source: gtm[1].js.2.dr String found in binary or memory: "vtp_html":"\n\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq||(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq||(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"init\",\"1210643745657267\");fbq(\"init\",\"1407587539516826\");fbq(\"track\",\"PageView\");\u003C\/script\u003E\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=\"1\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?id=1210643745657267\u0026amp;ev=PageView\u0026amp;noscript=1\"\u003E\u003C\/noscript\u003E\n\n", equals www.facebook.com (Facebook)
Source: gtm[1].js.2.dr String found in binary or memory: function Zo(a,b){}function $o(a,b,c){};var ap=!!n.MutationObserver,bp=void 0,cp=function(a){if(!bp){var b=function(){var c=K.body;if(c)if(ap)(new MutationObserver(function(){for(var e=0;e<bp.length;e++)M(bp[e])})).observe(c,{childList:!0,subtree:!0});else{var d=!1;ag(c,"DOMNodeInserted",function(){d||(d=!0,M(function(){d=!1;for(var e=0;e<bp.length;e++)M(bp[e])}))})}};bp=[];K.body?b():M(b)}bp.push(a)};var ep=["www.youtube.com","www.youtube-nocookie.com"],fp,gp=!1,hp=0; equals www.youtube.com (Youtube)
Source: unknown DNS traffic detected: queries for: ph-northwestmi.as.me
Source: notice[1].js.2.dr, notice[2].js.2.dr String found in binary or memory: http://consent-pref.trustarc.com/?type=squarespace2
Source: notice[2].js.2.dr String found in binary or memory: http://consent.trustarc.com/
Source: notice[1].js.2.dr, notice[2].js.2.dr String found in binary or memory: http://consent.trustarc.com/bannermsg?
Source: notice[1].js.2.dr, notice[2].js.2.dr String found in binary or memory: http://consent.trustarc.com/noticemsg?
Source: schedule[1].css.2.dr String found in binary or memory: http://fontawesome.io
Source: schedule[1].css.2.dr String found in binary or memory: http://fontawesome.io/license
Source: schedule[1].css.2.dr String found in binary or memory: http://getbootstrap.com)
Source: schedule[1].css.2.dr String found in binary or memory: http://getbootstrap.com/customize/?id=71302de5c334d16fa768)
Source: tippy[1].js.2.dr String found in binary or memory: http://opensource.org/licenses/MIT).
Source: TV4F7E56.htm.2.dr String found in binary or memory: http://status.acuityscheduling.com/
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://AcuityScheduling.com
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://acuityscheduling.com/
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://acuityscheduling.com/?utm_campaign=acuity&amp;utm_medium=referral&amp;utm_source=scheduling
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://acuityscheduling.com/blog
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://acuityscheduling.com/language-select.php
Source: login[1].htm.2.dr String found in binary or memory: https://acuityscheduling.com/login.php
Source: gtm[1].js.2.dr String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[1].js.2.dr String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: TV4F7E56.htm.2.dr, login[1].htm.2.dr String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: notice[1].js.2.dr String found in binary or memory: https://api-js-log.trustarc.com/error
Source: schedule[1].htm.2.dr String found in binary or memory: https://app.acuityscheduling.com/schedule.php?owner=21613168
Source: schedule[1].htm.2.dr String found in binary or memory: https://app.acuityscheduling.com/schedule.php?owner=21613168&calendarID=4953566
Source: efreechurchdose1covid20210310[1].htm.2.dr String found in binary or memory: https://app.acuityscheduling.com/schedule.php?owner=21613168&q=efreechurchdose1covid20210310&calenda
Source: j[1].js0.2.dr, j[1].js.2.dr String found in binary or memory: https://app.vwo.com/visitor-behavior-analysis/dist/codechecker/cc.min.js?r=
Source: tippy[1].js.2.dr String found in binary or memory: https://atomiks.github.io/tippyjs/getting-started/
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://carnation-cardioid-znps.squarespace.com/
Source: gtm[1].js.2.dr String found in binary or memory: https://cct.google/taggy/agent.js
Source: schedule[1].htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/built/csp/schedule.all.js?v=c1a593
Source: schedule[1].htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/built/csp/schedule.css?v=c1a593
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/css/marketingsquarespace.min.css?v=c1a593
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/font/Clarkson-Light.woff2
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/font/Clarkson-Medium.woff2
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/brand/logo-og.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-ipad-mini-9.7.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-ipad-pro-10.5.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-ipad-pro-11.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-ipad-pro-12.9.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-iphone-6s-7-8-plus.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-iphone-6s-7-8.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-iphone-x-xs.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-iphone-xr.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/launch-iphone-xs-max.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/site-gavins-goodies.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/site-llama-ste.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/site-schooner-coaching.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/site-under-pressure.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/site-whiskey-business.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/ask
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/ask.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/down.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/left.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/logo-ga.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/logo-paypal.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/logo-square.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/logo-stripe.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/logo-zapier.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/right.svg
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/screen-collect
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/screen-collect.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/screen-control
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/screen-control.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/screen-organize
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/screen-organize.png
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/support
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/img/marketing/squarespace/v3/support.jpg
Source: TV4F7E56.htm.2.dr, login[1].htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/js/swipe.js
Source: TV4F7E56.htm.2.dr, login[1].htm.2.dr String found in binary or memory: https://cdn-marketing.acuityscheduling.com/js/tippy.js
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://cdn.amplitude.com/libs/amplitude-7.1.0-min.gz.js
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://clover-trombone-al4y.squarespace.com/home
Source: notice[2].js.2.dr String found in binary or memory: https://consent.trustarc.com/
Source: notice[1].js.2.dr, notice[2].js.2.dr String found in binary or memory: https://consent.trustarc.com/get?name=icon_cross_large.svg
Source: notice[1].js.2.dr String found in binary or memory: https://consent.trustarc.com/log
Source: j[1].js0.2.dr, j[1].js.2.dr String found in binary or memory: https://dev.visualwebsiteoptimizer.com/e.gif?a=37352&s=j.php&e=
Source: j[1].js0.2.dr, j[1].js.2.dr String found in binary or memory: https://dev.visualwebsiteoptimizer.com/e.gif?s=mode_det&e=
Source: j[1].js0.2.dr, j[1].js.2.dr String found in binary or memory: https://dev.visualwebsiteoptimizer.com/j.php?mode=
Source: j[1].js0.2.dr, j[1].js.2.dr String found in binary or memory: https://dev.visualwebsiteoptimizer.com/v.gif?cd=
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://developers.acuityscheduling.com/
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://fife-hawk-s476.squarespace.com/
Source: schedule[1].css.2.dr, schedule[1].htm.2.dr String found in binary or memory: https://fonts.googleapis.com/css?family=Source
Source: css[1].css.2.dr String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff)
Source: schedule[1].css.2.dr String found in binary or memory: https://gist.github.com/71302de5c334d16fa768
Source: schedule[1].css.2.dr String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://help.acuityscheduling.com/hc/
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://help.acuityscheduling.com/hc/en-us/articles/219149797-Live-Training-Webinars
Source: login[1].js.2.dr String found in binary or memory: https://help.acuityscheduling.com/hc/en-us/requests/new
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://help.acuityscheduling.com/hc/requests/new
Source: gtm[1].js.2.dr String found in binary or memory: https://pagead2.googlesyndication.com
Source: gtm[1].js.2.dr String found in binary or memory: https://pagead2.googlesyndication.com/
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://pelican-orb-pnxf.squarespace.com/
Source: {747EC0F3-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://ph-northw.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e
Source: {747EC0F3-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://ph-northw.as.me/efreechurchdose1covid20210310#selectedTimes29ml5484939e
Source: {747EC0F3-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://ph-northw.as.me/schedule.php?owner=21613168&calendarID=4953566Root
Source: {747EC0F3-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://ph-northwduling.com/?utm_campaign=acuity&utm_medium=referral&utm_source=s
Source: ~DF1208AB93F940F0FF.TMP.1.dr String found in binary or memory: https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&re
Source: ~DF1208AB93F940F0FF.TMP.1.dr, {747EC0F3-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://ph-northwestmi.as.me/efreechurchdose1covid20210310
Source: ~DF1208AB93F940F0FF.TMP.1.dr String found in binary or memory: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes
Source: ~DF1208AB93F940F0FF.TMP.1.dr String found in binary or memory: https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes29ml5484939e2lnhrbbsir3&retu
Source: {747EC0F3-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://ph-northwestmi.as.me/efreechurchdose1covid20210310Root
Source: imagestore.dat.2.dr String found in binary or memory: https://ph-northwestmi.as.me/favicon.icoj
Source: ~DF1208AB93F940F0FF.TMP.1.dr String found in binary or memory: https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://plus.google.com/
Source: tippy[1].js.2.dr String found in binary or memory: https://popper.js.org
Source: gtm[1].js.2.dr String found in binary or memory: https://s.pinimg.com/ct/core.js
Source: {747EC0F4-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://secure.acuityscheduling.com/
Source: TV4F7E56.htm.2.dr, login[1].htm.2.dr, ~DF904815EF7ED92817.TMP.1.dr String found in binary or memory: https://secure.acuityscheduling.com/login.php
Source: ~DF1208AB93F940F0FF.TMP.1.dr, schedule[1].htm.2.dr String found in binary or memory: https://secure.acuityscheduling.com/preferences.php?action=myaccount&from=free-embed-popup
Source: gtm[1].js.2.dr String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://sponge-dachshund-jd56.squarespace.com/
Source: notice[1].js.2.dr, notice[2].js.2.dr String found in binary or memory: https://trustarc.mgr.consensu.org/
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://twitter.com/Acuity
Source: {747EC0F3-85EF-11EB-90E4-ECF4BB862DED}.dat.1.dr String found in binary or memory: https://www.acuityscheduling.com/?utm_campaign=acl
Source: schedule[1].htm.2.dr String found in binary or memory: https://www.acuityscheduling.com/?utm_campaign=acuity&amp;utm_medium=referral&amp;utm_source=schedul
Source: ~DF1208AB93F940F0FF.TMP.1.dr String found in binary or memory: https://www.acuityscheduling.com/?utm_campaign=acuity&utm_medium=referral&utm_source=scheduling
Source: ~DF1208AB93F940F0FF.TMP.1.dr String found in binary or memory: https://www.acuityscheduling.com/?utm_campaign=acuity&utm_medium=referral&utm_source=scheduling3&ret
Source: ~DF1208AB93F940F0FF.TMP.1.dr String found in binary or memory: https://www.acuityscheduling.com/?utm_campaign=acuity&utm_medium=referral&utm_source=schedulingHAcui
Source: imagestore.dat.2.dr String found in binary or memory: https://www.acuityscheduling.com/favicon.icoj
Source: gtm[1].js.2.dr String found in binary or memory: https://www.google.com
Source: gtm[1].js.2.dr String found in binary or memory: https://www.google.com/pagead/conversion_async.js
Source: schedule[1].htm.2.dr String found in binary or memory: https://www.google.com/support/adsense/bin/answer.py?answer=12654
Source: gtm[1].js.2.dr String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://www.instagram.com/acuityscheduling/
Source: get[1].2.dr String found in binary or memory: https://www.optimo.ch/information-eula
Source: get[1].2.dr String found in binary or memory: https://www.optimo.ch/information-eulaClarkson
Source: get[1].2.dr, get[1]0.2.dr String found in binary or memory: https://www.optimo.chhttps://www.optimo.ch/information-eula
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://www.squarespace.com/?source=acuityfooter
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://www.squarespace.com/?utm_source=acuityscheduling.com&utm_medium=referral&utm_campaign=homepa
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://www.squarespace.com/privacy
Source: TV4F7E56.htm.2.dr String found in binary or memory: https://www.squarespace.com/terms-of-service
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 13.224.94.16:443 -> 192.168.2.3:49736 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.94.16:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.89.109:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.224.89.109:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.184.84.60:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 54.184.84.60:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: classification engine Classification label: clean1.win@3/65@9/6
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File created: C:\Users\user\AppData\Local\Temp\~DFF5C0B19FBFB1A0C0.TMP Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe File read: C:\Users\desktop.ini Jump to behavior
Source: unknown Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5408 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5408 CREDAT:17410 /prefetch:2 Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe Automated click: agree
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 368837 URL: https://ph-northwestmi.as.m... Startdate: 15/03/2021 Architecture: WINDOWS Score: 1 11 favicon.ico 2->11 6 iexplore.exe 2 64 2->6         started        process3 process4 8 iexplore.exe 9 95 6->8         started        dnsIp5 13 dev.visualwebsiteoptimizer.com 34.96.102.137, 443, 49740, 49741 GOOGLEUS United States 8->13 15 cdn.amplitude.com 13.224.89.109, 443, 49744, 49745 AMAZON-02US United States 8->15 17 6 other IPs or domains 8->17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.96.102.137
 dev.visualwebsiteoptimizer.com United States
15169 GOOGLEUS false
52.89.211.128
 secure.acuityscheduling.com United States
16509 AMAZON-02US false
54.184.84.60
 api.amplitude.com United States
16509 AMAZON-02US false
13.224.89.109
 cdn.amplitude.com United States
16509 AMAZON-02US false
13.224.94.16
 consent.trustarc.com United States
16509 AMAZON-02US false
35.160.170.4
 ph-northwestmi.as.me United States
16509 AMAZON-02US false

Contacted Domains

Name IP Active
secure.acuityscheduling.com 52.89.211.128 true
api.amplitude.com 54.184.84.60 true
dev.visualwebsiteoptimizer.com 34.96.102.137 true
cdn.amplitude.com 13.224.89.109 true
ph-northwestmi.as.me 35.160.170.4 true
www.acuityscheduling.com 35.160.170.4 true
consent.trustarc.com 13.224.94.16 true
cdn-marketing.acuityscheduling.com unknown unknown
favicon.ico unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://ph-northwestmi.as.me/efreechurchdose1covid20210310#selectedTimes false
    		high
    https://www.acuityscheduling.com/?utm_campaign=acuity&utm_medium=referral&utm_source=scheduling false
      		high
      https://ph-northwestmi.as.me/efreechurchdose1covid20210310 false
        		high
        https://ph-northwestmi.as.me/client-login.php?owner=21613168&PHPSESSID=isj29ml5484939e2lnhrbbsir3&returnUrl=%2Fschedule.php%3Fowner%3D21613168%26calendarID%3D4953566 false
          		high
          https://ph-northwestmi.as.me/schedule.php?owner=21613168&calendarID=4953566 false
            		high